A damaged hard drive, especially when it comes to evidence drives, requires a complex imaging approach. It is necessary to avoid the drive’s further deterioration and data loss during damaged drive imaging. TaskForce system enhances your working with damaged evidence drives, minimizing the risk of losing data on the functioning parts of the head stack.
Diagnostics and selective head imaging
TaskForce’s built-in drive diagnostics module automatically checks all subsystems of the evidence drive. At the end of the diagnostics process, it provides a clear and detailed report about its electronics and motor, head stack, media surface, firmware and file system.
In the Heads section of the diagnostics report, TaskForce forensic imager provides detailed information about the state of each head. In addition, it offers the recommendation of the optimal strategy for your damaged drive imaging.
The above diagnostics report informs that the drive’s hardware has major issues. It also points to defects on the media and identifies a damaged head (Head #3). The report recommends that the damaged head is disabled in the imaging settings so that the good heads can be imaged first.
Atola engineers recommend imaging the good heads first. The system will prompt you to disable the bad head when you attempt to image the drive.
Alternatively, click the Image category in the left-side menu, select your source and target devices, click Continue. When you get to the Settings page, click Change to adjust the settings for your imaging session. In the Settings screen’s What to Image section, click on All sectors to configure the selective imaging.
Unselect the damaged head, Click Save and then click the Start button to launch your imaging session.
Multi-pass imaging of bad sectors
As the imaging session is running to its end, you can see that TaskForce has found errors on the space of the drive. And that space belongs to the Head #4. It is common that a drive with a bad head also contains errors on the platters that belongs to other heads.
When encountering a bad sector that belongs to a good head, TaskForce uses its multi-pass imaging algorithm. The algorithm handles the errors and attempts retrieving data from the bad sectors upon completing the imaging of good sectors. To read more about the multi-pass imaging system, please follow this link.
When selective imaging (from the good heads) is complete, the system pauses the imaging session. It then produces a detailed Imaging report that includes a log with record of all actions during this imaging session.
TaskForce automatically creates reports for every single action applied to each device connected to it. The reports are stored in the case management system.
Attempting to image the bad head
Having successfully retrieved data from the good heads of the damaged head evidence drive, you have two options:
- Replace the head stack before you get down to imaging of the remaining data. Keep in mind that data on the drive can become unreadable due to head stack replacement;
- Try imaging data with the Degraded or Damaged head. To image the unselected bad head, simply click Resume.
Atola TaskForce resumes the imaging session and focuses only on the area that belongs to the damaged head. Depending on the severity of the damage, it will safely retrieve as much data as possible. Alternatively, it will be skipping the unreadable sectors and log them in the imaging report.
When imaging the damaged head, pay attention to the progress. If the number of errors keeps growing, while the number of the imaged sectors remains unchanged, it is safe to assume that the head will not be able to read more sectors.
In such a case, it is advisable to pause the imaging and power down the drive to avoid more potential damage to the platters with the bad head.
Evaluating the imaging results
In the Imaging report you can see that TaskForce imaged 520,961,167 sectors out of 625,142,448, having extracted as much data from good heads as possible. TaskForce’s Segmented hashing functionality helps you verify the data on the evidence drive with the image. Even if not all data was retrieved.
Now you can evaluate how critical the remaining data on the drive may be based on the data retrieved from the good heads. You may already have sufficient evidence. Alternatively, you can choose to bring the drive to a clean room, where the drive’s head will be replaced. Then you will be able to image the areas belonging to the replaced head.
This damaged drive imaging strategy helps you save time by getting the data fast from the good heads first. And avoid causing more damage to the media.
For more details about the successfully imaged sectors and those impossible to retrieve data from, scroll down the report and check the Log.
- RAID imaging made easy with TaskForce - May 3, 2022
- Image. Anything. Fast.What makes TaskForce the ultimate forensic imager - February 9, 2022
- RAID configuration detection in Atola TaskForce - April 7, 2021
Olga Milishenko
Olga believes that marketing is about letting the target audience fall in love with your product. She takes pleasure in catching the coolest features of Atola imagers with her camera.
